llm-redact dashboard

type	redacted	restored	warned⚠	blocked
none yet

Routing upstreams state and spend this period — credential MODE only, never a value

upstream	protocol	credential	cost	state	requests	re-issues/h	tokens	USD	budget

Recent requests include persistent audit history

time	provider	method	path	status	ms	stream	redacted	warned⚠	restored	user
loading…

Vault sessions

session	entries	first	last
loading…

prune sessions idle longer than (days)

Pruning deletes whole idle sessions from the sqlite vault — their placeholders can no longer be restored. The active session is never pruned here.

Named users

status	email	name
loading…

invite

Codes are emailed when [email] is configured; otherwise the code appears above for manual delivery. The per-user key is shown exactly once, at llm-redact users verify, never here.

Redaction preview

Paste representative prompt text to see what the CURRENT config would redact, warn on, or block — no request is sent upstream and nothing is stored.

redacted (what the upstream would receive)

Configuration

inject system note fuzzy rehydration max body bytes

Detection rules all built-in rules (including ones added by future versions)

Per-rule mode: redact substitutes a placeholder; warn only counts — the value IS sent upstream unredacted (including anything a longer warn-mode match overlaps); block rejects the whole request with a 400.

languages (comma-separated ISO 639-1 codes; blank = all — national-id rules outside the list are not built, universal rules like emails and vendor keys always run)

Allowlist (exact values, one per line — shown here, unlike other endpoints)

Allowlist patterns (regex, one per line)

Per-type allowlist (TYPE: value per line — the value is allowed only when matched as that detector type)

Deny strings (always redacted; win every overlap; ignore the allowlist and modes)

value	case sensitive	type

MCP exempt servers (server name/label per line — their MCP content blocks bypass detection entirely)

Content addressed to or returned by these MCP servers is forwarded unredacted. Use only for servers you run and trust.

Custom rules

name	type	pattern	priority	validator	required	anchors

NER (person-name detection)

Each backend needs its extra installed (ner for spacy, gliner, presidio, stanza, hf) plus the model where applicable — enabling without it is rejected with the exact install command.

enabled backends (each runs when checked) spacy gliner presidio stanza hf spacy model (blank = en_core_web_sm) gliner model (blank = urchade/gliner_small-v2.1) presidio model (blank = en_core_web_sm) stanza model (blank = language default) hf model (blank = dslim/bert-base-NER) entities (comma-separated) max chars scanned per string language score threshold

Rule toggles above are the single source of truth per placeholder type: a type disabled there is suppressed for NER too (presidio folds these into the built-in types). Currently:

Upstreams

Custom upstreams are OpenAI-compatible backends served under /custom/<name>/ (point the tool's OPENAI_BASE_URL there); names are lowercase [a-z0-9-].

Saving rewrites the config file (comments are not preserved; one .bak of the previous file is kept) and applies immediately — no restart needed for these settings.

Restart-required settings read-only

Change these in the config file, then restart the proxy.

llm-redact

Detections / restores by type